auth fixes

apps/api/app/auth/dependencies.py

@@ -12,21 +12,25 @@ bearer_scheme = HTTPBearer(auto_error=False)
 
 
 async def _get_or_create_dev_user(session: AsyncSession) -> User:
-    """Return or create the fixed development user."""
     result = await session.execute(
         select(User).where(User.authentik_sub == "dev-user")
     )
     user = result.scalar_one_or_none()
     if user is None:
-        user = User(
-            authentik_sub="dev-user",
-            email="dev@localhost",
-            display_name="Dev User",
-            is_active=True,
+        result = await session.execute(
+            select(User).where(User.email == "dev@localhost")
         )
-        session.add(user)
-        await session.commit()
-        await session.refresh(user)
+        user = result.scalar_one_or_none()
+        if user is None:
+            user = User(
+                authentik_sub="dev-user",
+                email="dev@localhost",
+                display_name="Dev User",
+                is_active=True,
+            )
+            session.add(user)
+            await session.commit()
+            await session.refresh(user)
     return user
 
 
@@ -44,7 +48,7 @@ async def get_current_user(
         )
 
     try:
-        claims = decode_token(token.credentials)
+        claims = await decode_token(token.credentials)
     except Exception as exc:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -69,6 +73,16 @@ async def get_current_user(
     user = result.scalar_one_or_none()
 
     if user is None:
+        result = await session.execute(
+            select(User).where(User.email == email)
+        )
+        existing_user = result.scalar_one_or_none()
+        if existing_user:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail=f"User with email {email} already exists",
+            )
+
         user = User(
             authentik_sub=authentik_sub,
             email=email,
@@ -105,7 +119,7 @@ async def validate_traefik_auth(
         )
 
     try:
-        claims = decode_token(token.credentials)
+        claims = await decode_token(token.credentials)
     except Exception as exc:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,